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DETAILED ACTION 

The Request for Continued Examination has been entered and accepted. 

Response to Arguments 

Applicant's arguments filed 10/31/07 have been fully considered but they are not 
persuasive. 

Applicant argues a confidence level, "local or organizational network", and new claims 
127, and 128. 

The examiner asserts that the amendment of a local or organizational network is in the 
preamble, and thus is not given patentable weight. This limitation can be found in 
Kephart US 6,732,149 because the network is a company or organizational network. This 
network prevents transmission of certain documents. 

The applicant argues a confidence level to help determine if content is worth monitoring. 
Kephart teaches a system of threshold levels (or confidence) which help determine if the 
content is worth monitoring. The examiner would also assert that the binary "yes/no" 
matching as taught in Kephart also qualify as confidence levels, mainly, confident, or not 
confident. 
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New claim 127 is met because one local endpoint device (user A) has reporting of its 
events taken. New claim 128 is met because Kephart teaches adding a message to 
content (that it is undesirable). 

Examiner notes that the applicant has argued points from the instant specification. The 
examiner encourages the applicant to incorporated those items into the claim limitations. 

Citations for all of Kephart's teachings can be found in the rejection below. 



Claim Rejections - 35 USC § 101 
35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

The claimed invention is directed to non-statutory subject matter. Claims 1, 125-128 are 
directed towards non-statutory subject matter. Each system in the claims may be 
interpreted as software only. The examiner encourages the applicant to incorporate a 
processor and or a computer readable medium into the claims to show that the invention 
falls under statutory subject matter. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 
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A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another filed in the United 
States before the invention thereof by the applicant for patent, or on an international application by another who 
has fulfilled the requirements of paragraphs (1), (2), and (4) of section 371(c) of this title before the invention 
thereof by the applicant for patent. 

The changes made to 35 U.S. C. 102(e) by the American Inventors Protection Act of 1999 
(AIPA) and the Intellectual Property and High Technology Technical Amendments Act 
of 2002 do not apply when the reference is a U.S. patent resulting directly or indirectly 
from an international application filed before November 29, 2000. Therefore, the prior art 
date of the reference is determined under 35 U.S.C. 102(e) prior to the amendment by the 
AIPA (pre-AIPA 35 U.S.C. 102(e)). 

Claims 1-4. 11, 17, 35, 37, 51, 56-65, and 109-112, 125-128 are rejected under 35 
U.S.C. 102(e) as being anticipated by Kephart US 6,732,149. 

As per claims 1-4, 11,51, 56-65, 109, 1 10, 1 1 1, 1 12, 125 Kephart teaches a signature 
extractor to extract a signature from monitored data, (Col 1 1 lines 45-48). Kephart 
teaches a database of preobtained signatures, (Col 9 lines 55-60). Kephart teaches the 
content is internally generated previous to extracting (generating a message). Kephart 
teaches a comparator for comparing the comparing the extracted signature with the 
signature from the database, (Col 1 1 lines 50-60). Kephart teaches the comparison 
searches for predetermined content, (Col 10 lines 39-55). Kephart teaches a decision 
making unit for producing an enforcement decision, (Col 16 lines 19-35). Kephart 
teaches prevention of transmitting certain content over a network to control distribution, 
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(Col 10 lines 7-15). Kephart teaches a confidence level to decide (levels of matching) 
(Col 15 line 55 to Col 16 line 35). Kephart teaches the network is an organizational 
network (Company A) (Fig 2). 

As per claim 17, Kephart teaches the system is used to extract signatures from messages 
or emails (multimedia) , (Col 10 lines 5-10). 

As per claims 35, and 37, Kephart teaches hashing, (Col 1 1 lines 50-55). 

As per claim 126-128, Kephart teaches a signature extractor to extract a signature from 
monitored data, (Col 1 1 lines 45-48). Kephart teaches a database of preobtained 
signatures, (Col 9 lines 55-60). Kephart teaches the content is internally generated 
previous to extracting (generating a message). Kephart teaches a comparator for 
comparing the comparing the extracted signature with the signature from the database, 
(Col 1 1 lines 50-60). Kephart teaches the comparison searches for predetermined 
content, (Col 10 lines 39-55). Kephart teaches a decision making unit for producing an 
enforcement decision, (Col 16 lines 19-35). Kephart teaches prevention of transmitting 
certain content over a network to control distribution, (Col 10 lines 7-15). 
Kephard teaches the content is not sent out of the network because if a signature is found 
on an inbound or outbound scan, an action is taken including automatically deleting, (Col 
5 lines 60-67, Col 16 lines 20-25). ). Kephart teaches a confidence level to decide 
(levels of matching) (Col 15 line 55 to Col 16 line 35). Kephart teaches reporting events 
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at a local endpoint (user A) (Col 9 lines 45-50). Kephart teaches adding a message to 
matching data (labeling as undesirable) (Col 7 lines 48-55). 



Claim Rejections - 35 USC §103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



Claims 5 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 
6,732,149 in view of Barton US 5,646,997. 



As per claim 5, Kephart does not teach meta information. 

Barton teaches deriving a signature from meta information, (Claim 14) 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the meta-data of Barton so that the signature is secure and can't be 
modified, (Col 3 lines 48). 
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Claims 6-9, are rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart 
US 6,732,149 in view of Vaidya US 6,279,113. 



As per claims 6-9, Kephart teaches extracting a signature from data, (Col 1 1 lines 45-48). 
Kephart does not teach the multi-level security. 

Vaidya teaches examining every layer to extract a signature, (Col 7 lines 15-24). It 
would be obvious to one of ordinary skill in the art to modify the system of Kephart with 
the multiple layers of Vaidya because it is advantageous to be able to detect a signature in 
any level, (Col 4 lines 28-33). 

Claim 10 rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 
6,732,149 in view of Vaidya US 6,279,1 13 in view of Barton US 5,646,997. 

As per claims 10 Kephart teaches extracting a signature from data, (Col 1 1 lines 45-48). 
Kephart does not teach the multi-level security. 

Vaidya teaches examining every layer to extract a signature, (Col 7 lines 15-24). It 
would be obvious to one of ordinary skill in the art to modify the system of Kephart with 
the multiple layers of Vaidya because it is advantageous to be able to detect a signature in 
any level, (Col 4 lines 28-33). 

Barton teaches deriving a signature from meta information, (Claim 14) 

It would have been obvious to one of ordinary skill in the art to modify the previous 
system of Kephart-Vaidya with the meta-data of Barton so that the signature is secure and 
can't be modified, (Col 3 lines 48). 
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Claims 12-14 rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart 
US 6,732,149 in view of Kirby US 5,898,784. 

As per claim 12, Kephart does not specifically teach a packet network. 

Kirby teaches that the network is composed of passing packets, (Col 4 lines 3-7). 

It would have been obvious to one of ordinary skill in the art to use the packet network of 

Kirby with the data monitoring of Kephart, so because the method of packet switching 

has high efficiency for digital data networking. 

As per claims 13, and 14, Kephart does not specifically teach extracting a signature from 
the header of a packet. 

Kirby teaches extracting a signature from the packet header, (Col 5 lines 13-20). 
It would have been obvious to one of one of ordinary skill in the art to be able to monitor 
the headers of Kirby in the system of Kephart because it allows signature checking 
without decryption. 

Claims 15 and 16, are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Schlener US 6,182,157. 

As per claims 15 and 16, Kephart does not teach software agents. 
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Kephart teaches software agents monitoring a number of nodes, (Col 4 lines 3-6, Fig 1). 

It would have been obvious to one of ordinary skill in the art to use the software agents of 
Schlener with the system of Kephart because software agents are independent and 
autonomous. 

Claims 18-23, 41, 42, and 48 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kephart US 6,732,149 in view of Vogel US 6,055,663. 

As per claims 18-23, 41, 42, and 48 Kephart teaches taking signatures from multimedia 
data (Col 10 lines 5-10). Kephart does not teach analyzing and combining data into a 
single communication. 

Vogel teaches analyzing and combining two packet signals into a single channel, (Col 2 
lines 35-45). It would have been obvious to one of ordinary skill in the art to modify the 
system of Kephart with the communication method of Vogel because it provides 
advantageous error-protection, (Col 2 lines 18-23). 



Claims 24-26, 113, 114, and 119-124 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kephart US 6,732,149 in view of Moskowitz US 2002/0071556. 

As per claims 24-26, 113,1 14, and 1 19-124 Kephart does not teach compression. 
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Moskowitz teaches a signature used in compressed data. Moskowitz teaches 
stegonography, [0020]. 

It would have been obvious to modify the system of Kephart with the compression of 
Moskowitz because it allows faster file transfer. 

Claims 27-30, 67, 68, are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Thomlinson US 6,389,535. 

As per claims 27-30, 67, 68, Kephart does not teach entropy and encryption. 

Thomlinson teaches use of entropy and encryption, (Claim 7, 8). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the encryption of Thomlinson because it enhances security. 

Claims 31-34, 39, 40, are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Rhoads US 2002/0012443. 

As per claims 31-34, 39, 40, Kephart teaches signature extraction, Kephart does not teach 
a media player with a format detector. 

Rhoads teaches a media player with format detection, and audio and video data [0087] 
[0052], [0041]. 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the playback device of Rhoads, because Rhoads provides portability. 
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Claims 36 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 
6,732,149 in view of Verhoorn III US 6,725,371. 

As per claim 36, Kephart does not teach a buffer. 

Verhoorn III teaches using a buffer associated with a signature extractor from packet 
data, (abstract). It would have been obvious to one of ordinary skill in the art to modify 
the system of Kephart with the buffer or Verhoorn III because the buffer allows multiple 
packets to be stored and processed. 

Claim 38, is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 
6,732,149 in view of Robison US 5,043,885. 

As per claim 38, Kephart does not teach a hash with offset. 

Robinson teaches a hashing system with offset, (Col 6 lines 15-25). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the hashing of Robinson because it provides a way to index data. 

Claims 43-47, 49, 50, 52-55, 66, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kephart US 6,732,149 in view of Hile US 5,319,776. 
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As per claims 43-47, 49, 50, Kephart teaches comparing signatures to get the best result. 
Kephart does not teach multiple tests for signatures. 

Hile teaches multiple tests for signatures, (Col 1 lines 55-60). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the multiple testing of Hile because it provides redundancy. 

As per claims 52-55, 66, Kephart teaches comparing signatures and checking 
probabilities of matching with other comparisons, (Col 1 1 line 64-Col 12 line 5). 

Claims 69, 70, 73, 86, 87, 91-99 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kephart US 6,732,149 in view of Olnowich US 6,389,476 

As per claims 69, and 70, 91-99 Kephart teaches a signature extractor to extract a 
signature from monitored data, (Col 1 1 lines 45-48). Kephart teaches a database of 
preobtained signatures, (Col 9 lines 55-60). Kephart teaches a comparator for comparing 
the comparing the extracted signature with the signature from the database, (Col 1 1 lines 
50-60). Kephart teaches the comparison searches for predetermined content, (Col 10 
lines 39-55). Kephart teaches a decision making unit for producing an enforcement 
decision, (Col 16 lines 19-35). Kephart teaches prevention of transmitting certain content 
over a network to control distribution, (Col 10 lines 7-15). Kephart does not teach 
bandwidth management. 
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Olnowich teaches a system that controls the speed of messages over a network, (col 5 
lines 60-65). It would be obvious to one of ordinary skill in the art to use the 
transmission speed of zero for prevention of transmission of content to prevent sensitive 
content from leaving a defined network. 

As per claim 73 Kephart teaches the system is used to extract signatures from messages 
or emails (multimedia) , (Col 10 lines 5-10). 

As per claims 86, 87 Kephart teaches hashing, (Col 1 1 lines 50-55). 

Claims 71, and 72 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Olnowich US 6,389,476 in view of Schlener US 
6,182,157. 

As per claims 71, and 72 Kephart-Olnowich does not teach software agents. 

Kephart-Olnowich teaches software agents monitoring a number of nodes, ( Kephart Col 
4 lines 3-6, Fig 1). 

It would have been obvious to one of ordinary skill in the art to use the software agents of 
Schlener with the system of Kephart-Olnowich because software agents are independent 
and autonomous. 
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Claims 74-76 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Olnowich US 6,389,476 in view of Vaidya US 
6,279,113. 

As per claims 74-76 Kephart-Olnowich teaches extracting a signature from data, (Col 1 1 
lines 45-48). Kephart-Olnowich does not teach the multi-level security. 

Vaidya teaches examining every layer to extract a signature, (Col 7 lines 15-24). It 
would be obvious to one of ordinary skill in the art to modify the system of Kephart with 
the multiple layers of Vaidya because it is advantageous to be able to detect a signature in 
any level, (Col 4 lines 28-33). 

Claims 77, 78, and 115-118 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kephart US 6,732,149 in view of Olnowich US 6,389,476 in view 
of Moskowitz US 2002/0071556. 

As per claims 77, 78, and 115-118 Kephart-Olnowich does not teach compression. 

Moskowitz teaches a signature used in compressed data. Moskowitz teaches 
stegonagraphy, [0020]. 

It would have been obvious to modify the system of Kephart-Olnowich with the 
compression of Moskowitz because it allows faster file transfer. 
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Claims 79-82, 100, 101, 102 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kephart US 6,732,149 in view of Olnowich US 6,389,476 in view 
of Thomlinson US 6,389,535. 

As per claims 79-82, 100-102 Kephart-Olnowich does not teach entropy and encryption. 

Thomlinson teaches use of entropy and encryption, (Claim 7, 8). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart-Olnowich with the encryption of Thomlinson because it enhances security. 

Claims 83, 84, 85, 89, 90 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kephart US 6,732,149 in view of Olnowich US 6,389,476 in view of Rhoads US 
2002/0012443. 

As per claims 83, 84, 85, 89, and 90 Kephart-Olnowich teaches signature extraction, 
Kephart-Olnowich does not teach a media player with a format detector. 

Rhoads teaches a media player with format detection, and audio and video data [0087] 
[0052], [0041]. 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart-Olnowich with the playback device of Rhoads, because Rhoads provides 
portability. 
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Claim 88 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 
6,732,149 in view of Olnowich US 6,389,476 in view of Robison US 5,043,885. 

As per claim 88, Kephart-Olnowich does not teach a hash with offset. 

Robinson teaches a hashing system with offset, (Col 6 lines 15-25). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart-Olnowich with the hashing of Robinson because it provides a way to index data. 

Claims 103-108 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Olnowich US 6,389,476 in view of GUPTA WO 
99/63727. 

As per claims 103-108, Kephart-Olnowich does not teach firewalls or trust networks. 

Gupta teaches a system of firewalls to protect a trusted network, (Abstract). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart-Olnowich with the firewall of Gupta because firewalls enhance the security of 
the network. 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Johnson US 5,428,795 teaches a network monitoring system to prevent 
transmission of confidential data. Malkin 6,317,795 teaches dynamically modifying data. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to CHRISTOPHER J. BROWN whose telephone number is 
(571)272-3833. The examiner can normally be reached on 8:30-6:00. 
If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kambiz Zand can be reached on (571)272-381 1 . The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from cither Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO 
Customer Service Representative or access to the automated information system, call 
800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Christopher J Brown/ 

Primary Examiner, Art Unit 2134 
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